CVE-2022-25168: Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
First published: Thu Aug 04 2022(Updated: )
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Hadoop | >=2.0.0<=2.10.1 | |
| Apache Hadoop | >=3.0.0<=3.2.3 | |
| Apache Hadoop | >=3.3.0<=3.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-25168?
CVE-2022-25168 is a vulnerability in Apache Hadoop's FileUtil.unTar(File, File) API that allows an attacker to inject arbitrary commands.
What is the severity of CVE-2022-25168?
CVE-2022-25168 has a severity rating of critical.
Which versions of Apache Hadoop are affected by CVE-2022-25168?
CVE-2022-25168 affects Apache Hadoop versions 2.0.0 to 2.10.1 and versions 3.0.0 to 3.2.3.
How can an attacker exploit CVE-2022-25168?
An attacker can exploit CVE-2022-25168 by injecting arbitrary commands through the FileUtil.unTar(File, File) API.
Is there a fix available for CVE-2022-25168?
Yes, a fix for CVE-2022-25168 is available. It is recommended to update Apache Hadoop to a patched version.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/apache
- canonical/apache hadoop
- version/apache hadoop/2.0.0
- version/apache hadoop/2.10.1
- version/apache hadoop/3.0.0
- version/apache hadoop/3.2.3
- version/apache hadoop/3.3.0
- version/apache hadoop/3.3.2